Extracted

• • Target

    e96d2ca9c037b75bc9dbe781ebd8c6f1884dbf9fb9da6de42ba06996ba510d4b

  • Size

    650KB

  • MD5

    b59b9e6ed4788e8665a9c5c4af204a17

  • SHA1

    8bb2312bbef8c5daaed16791fff789bde5037b34

  • SHA256

    e96d2ca9c037b75bc9dbe781ebd8c6f1884dbf9fb9da6de42ba06996ba510d4b

  • SHA512

    5ce3128a760cc6161e6d391247d596378aecffb131dcc9ba0b70dc87039ce4b89da64e7ae89bea748c919bd6d1fd777bd2f3de8ac3aafd9135657c29e7210f0e

  • SSDEEP

    6144:MWusAIFB++velibxPyp/64wjOjn6cB3rZtT/Yq3v9Auky+4N137Am/vF:Mz7IFjvelQypyfy7z6u7+4D37Am/vF

  Score

  10^/10

  collectioncredential_accessdiscoverypersistencespywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2